Security Requirements for Selecting an HR System: A Buyer’s Guide to Employee Data, Lifecycle Integrity and Testing

An HR system is both the most sensitive store of employee personal data and, in most organisations, the authoritative source that creates, changes and removes every workforce identity. A weak HR platform therefore fails twice: it exposes salaries, bank details, health and diversity records, and it lets a single edited record grant access, divert pay or keep a leaver's accounts alive. HR information systems (HRIS), human capital management (HCM) suites and payroll platforms are usually chosen by HR and finance on process fit and cost, with security reduced to a questionnaire. This vendor-neutral buyer's guide sets out the security requirements to include in the RFP, how to weight them, what to ask vendors and how to test the answers. It is for security architects, identity teams, data protection officers and HR technology leads.

Key takeaways

• Treat the HR system as identity infrastructure. If it drives joiner, mover and leaver events into the identity provider, a changed job code or termination date is an access change, so its integrity matters as much as its confidentiality.
• Employee data includes special category data. Health, ethnicity, trade union membership and biometric data fall under GDPR Article 9, so require field-level security, not only module-level roles.
• Bank detail changes are a fraud path. The FBI has described criminals phishing employees' payroll logins, changing direct deposit details and suppressing the alert emails; require step-up authentication, notifications and holds on payment changes.
• Integration accounts outnumber administrators. Payroll, benefits, background checks, identity provisioning and analytics all hold credentials with broad read rights over every employee.
• Test the lifecycle, not just the login. In the proof of concept, terminate a test worker and time how long it takes for access to disappear everywhere downstream.

Define requirements

Agree the following with HR, payroll, the identity team and the data protection officer before talking to vendors:

• Modules in scope: core HR records, payroll, benefits, recruitment and applicant tracking, performance, learning, time and attendance, and employee self-service. Recruitment adds candidate data and an external-facing portal; time and attendance may add biometric clocking.
• Population: employees, contractors, contingent workers, candidates, alumni and dependants. Each has different retention rules and access paths.
• Authoritative source role: will the HR system drive provisioning into the identity provider (HR-driven provisioning), and for which populations? If contractors are managed elsewhere, record where. See the Identity Lifecycle Event Design Guide and the Identity Data Quality and Authoritative Sources Guide.
• Jurisdictions: GDPR Article 88 allows EU Member States to set more specific rules for processing employee data, including through collective agreements, with safeguards on transparency, transfers within a corporate group and workplace monitoring. List the countries in scope and any works council consultation needed.
• Data classes: identity documents, national insurance or social security numbers, bank details, salary, health and absence records, disciplinary and grievance cases, diversity data and right-to-work evidence.
• Integrations: payroll bureau, pension and benefits providers, background screening, learning platforms, finance, the identity provider and people analytics. Count them.
• Exit: how employee records, documents, audit history and configuration will be exported, and what the vendor deletes and when.

Small organisations using a single SaaS HR and payroll product should prioritise SSO with MFA, bank detail change controls, field-level restrictions on sensitive data and leaver timing. Large or multinational organisations should add per-country data segregation, delegated HR administration by region, customer-managed keys, workflow approvals for privileged role changes and contractual audit log retention.

Capability areas

Access for HR staff, managers and employees

• Single sign-on and MFA: SAML 2.0 or OpenID Connect for every user type, including employee self-service, with phishing-resistant MFA enforced through the identity provider. CISA's Secure by Demand guide asks buyers whether standards-based SSO is available at no extra cost.
• Pre-hire and post-exit access: a defined way for new joiners to reach onboarding before their corporate identity exists, and for leavers to reach payslips and tax documents afterwards, without falling back to weak local passwords.
• Security model: roles constrained by organisation, location, cost centre and population, with field-level restrictions so a line manager can see a report's job details but not their health or bank data.
• Delegation and proxy: controls on manager delegation and administrator proxy (acting as another user), with both identities recorded and the feature limited to named roles.
• Privileged role changes: approval workflow and alerting when anyone is granted security administration, payroll administration or access to all workers.

Integrity of lifecycle and payment data

• Effective-dated history for every change to job, manager, organisation, status and termination date, with who made the change and through which channel (user interface, import, API).
• Approval workflows for hires, terminations, rehires and changes that alter access-relevant attributes, with separation of duties between initiator and approver.
• Bank detail changes protected by step-up authentication, notification to the employee's existing contact details and a configurable hold before the next pay run. The FBI's payroll diversion advisory recommends scrutinising direct deposit change requests and monitoring logins outside normal hours. See the Payroll Diversion Fraud Guide.
• Controls on bulk imports and mass updates: who can run them, preview of changes, and an audit record for each changed field.

Protection of employee data

• Encryption in transit and at rest with an option for customer-managed keys, and documented separation between customer tenants.
• Masking of national identifiers and bank details by default, with reveal logged.
• Restricted case types for disciplinary, grievance, whistleblowing and medical matters, invisible even to most HR administrators.
• Retention rules by record type and country, legal hold, and verified deletion. See the Data Retention and Secure Deletion Guide.
• Support for subject access requests, including export of all data about one worker. See the DSAR Guide: Handling Data Subject Requests.
• Controls on reports and exports: who can build ad hoc reports across all workers, whether exports are logged, and whether sensitive fields can be excluded from report sources.

Integrations and non-human identities

• A dedicated integration account per connection, non-interactive, with a security group limited to the fields and populations that integration needs.
• OAuth clients or certificates with expiry instead of passwords for integration accounts, and an inventory with owner and last use. See the Workday Integration System Users Guide for how one platform models this.
• Outbound file transfers encrypted (SFTP with key authentication or PGP-encrypted files) and inbound files validated before they change records.
• Marketplace or partner app review, with the data each app reads shown before approval.

Audit, logging and vendor assurance

• Audit events for sign-ins, role and security group changes, proxy sessions, views of sensitive fields, report runs, exports, bank detail changes and integration activity, exportable to your SIEM.
• Security logs retained for at least six months at no additional charge, the baseline CISA's Secure by Demand guide sets for cloud and SaaS providers.
• Independent assurance covering the modules and region, a published vulnerability disclosure policy, and a processor contract with the GDPR Article 28(3) terms, including sub-processor approval, assistance with breaches and deletion or return at the end of the service.
• Breach notification terms that allow you to meet GDPR Article 33: notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals.

Evaluation criteria

Weights are illustrative. Raise lifecycle integrity if the HR system will drive automated provisioning, and data protection if you hold health or biometric data.

The threats below shape these requirements. ATT&CK IDs are from ATT&CK v20.

Where identity fits

The HR system sits at the start of the identity lifecycle. NIST SP 800-53 controls PS-4 (personnel termination) and PS-5 (personnel transfer) expect access to be revoked or adjusted when people leave or move, and AC-2 (account management) depends on accurate triggers. If the HR feed is late, wrong or editable by the wrong people, every downstream access control inherits the error. Require that the provisioning connector supports future-dated hires and terminations, handles rehires and conversions from contractor to employee without duplicate identities, and alerts when an expected leaver event is not received. See the Joiner-Mover-Leaver Guide and, where AI agents will act inside HR processes, the AI Agents in HR Guide.

Questions to ask vendors

• Can field-level security hide health, bank, diversity and national identifier fields from roles that can otherwise see a worker's record?
• How do new joiners and leavers authenticate before and after their corporate identity exists, and can that path enforce MFA?
• What controls apply to a self-service bank detail change: step-up, notification to existing contacts, hold before payroll, and an audit record?
• How is administrator proxy or impersonation logged, and can it be limited to named roles?
• Which changes are captured in the audit trail with the channel (interface, import, API) and the integration account that made them?
• How quickly is a termination sent to our identity provider, and how are future-dated and retroactive terminations handled?
• Can every integration use its own scoped account with an expiring credential, and can we list all of them with last use?
• Are views of sensitive fields, report runs and exports logged, kept for how long at no extra cost, and streamed to our SIEM how?
• In which regions is our data stored and supported, who are your sub-processors, and how are we told of changes under GDPR Article 28(2)?
• What is exported and deleted at the end of the contract, and in what timescale?

Red flags

• Security defined only at module level, so any HR user sees every field for every worker.
• Employee self-service on local passwords with no MFA because SSO is a premium add-on.
• Bank detail changes taking effect immediately with no notification or hold.
• Integration accounts that are ordinary user accounts with passwords that never expire.
• No audit of report runs or exports, or audit history only for core fields.
• Leaver events sent only in a nightly batch with no way to send an urgent termination.
• An assurance report that excludes payroll or the region holding your data.

Proof of concept

1. Connect the trial tenant to your identity provider with SSO and MFA for administrator, manager and employee personas; confirm local login is disabled or limited to break-glass accounts.
2. Build a line manager role and confirm it cannot see health, bank or national identifier fields for direct reports, then check the audit trail for an administrator who reveals one.
3. As a test employee, change bank details through self-service and confirm the step-up prompt, the notification to the existing contact address, the payroll hold and the audit record.
4. Hire, transfer and terminate a test worker, including a future-dated termination, and time how long it takes for each event to reach the identity provider.
5. Create two integration accounts with different field scopes, call the API with each, and confirm the second cannot read fields outside its scope; revoke one credential and confirm only that integration fails.
6. Run an ad hoc report across all workers and an export, then confirm both appear in your SIEM with the user identity.
7. Export all data for one test worker as you would for a subject access request, then delete the worker under the retention rule and confirm the result.

Use synthetic worker data only. Score each step pass or fail; if lifecycle timing, field-level security or payment change controls fail, do not proceed to contract on the promise of a later release.

After selection: measures and common failure patterns

Once live, track: median time from a termination entered in the HR system to disabled access in the identity provider; the number of bank detail changes made within a short window of a new device or location sign-in; roles with access to all workers' sensitive fields; integration credentials older than your rotation standard; and the share of HR, manager and employee sign-ins through SSO with phishing-resistant MFA. The Security Responsibilities for HR Teams Guide covers the HR side of these controls.

• Retroactive terminations: a leaver is entered weeks after their last day and the access was never removed in between.
• Contractors outside the system: contingent workers are tracked in spreadsheets, so they have accounts with no authoritative leaver event.
• Implementation partner access left in place: consultants keep administrator roles after go-live.
• Broad report sources: anyone with report-writing rights can build a report that includes salary or health fields.
• Payroll change by email: the system has controls, but payroll staff still accept bank detail changes by email or phone without call-back verification.

Framework mapping

Standards and references

• EUR-Lex: Regulation (EU) 2016/679 (GDPR)
• CISA: Secure by Demand Guide
• FBI IC3: Cybercriminals Utilize Social Engineering Techniques to Obtain Employee Credentials to Conduct Payroll Diversion
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0
• NCSC: The Cloud Security Principles
• GDPR Article 88: Processing in the context of employment

How NHI Mgmt Group can help

We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.

Related NHI Mgmt Group resources: Workday Security Guide · BambooHR Security · Joiner-Mover-Leaver Guide · Payroll Diversion Fraud Guide